Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager DR

Summary There is vulnerability in npm which affects IBM VM Recovery Manager DR Vulnerability Details Third Party Entry: 184667 DESCRIPTION: Node.js npm-registry-fetch module could allow a remote attacker to obtain sensitive information, caused by the storing of user credentials in the log file. B...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2020-15095)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js CVE-2020-15095 Vulnerability Details Third Party Entry: 184667 DESCRIPTION: Node.js npm-registry-fetch module information disclosure CVSS Base score: 7.5 CVSS Temporal Score: See:...

Information Disclosure

npm-registry-fetch is vulnerable to information disclosure. The vulnerability exists as as it does not mask sensitive information that may be logged through the malicious URL such as ://:@::/...

Sensitive Data Exposure

Overview Affected versions of npm-registry-fetch are vulnerable to an information exposure vulnerability through log files. The package supports URLs like ://:@::/. The password value is not redacted and is printed to stdout and also to any generated log files. Recommendation Upgrade to version...

@adpt/cli (>=0.4.0-next.27, <=0.4.0-next.28), @alasdair/check-engines (1.0.0) +142 more potentially affected by unknown CVE via npm-registry-fetch (>=5.0.0, <=8.1.0)

npm-registry-fetch NPM version =5.0.0, =0.4.0-next.27, =0.1.0, =0.21.0, =1.0.0, =1.0.0, =0.1.0, =0.2.0, =0.14.0, =4.0.13, =3.1.10, =2.3.0, =3.1.10, =3.1.10, =3.1.11 and more Source cves: unknown CVE Source advisory: OSV:GHSA-JMQM-F2GX-4FJV...

GHSA-JMQM-F2GX-4FJV Sensitive information exposure through logs in npm-registry-fetch

Affected versions of npm-registry-fetch are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like ://:@::/. The password value is not redacted and is printed to stdout and also to any generated log files...

@swydo/custom-integrations (>=0.10.0, <=1.0.25), @testim/testim-cli (1.142.0) potentially affected by unknown CVE via npm-registry-fetch (4.0.0)

npm-registry-fetch NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on npm-registry-fetch and may be impacted: - @swydo/custom-integrations =0.10.0, =1.0.25 - @testim/testim-cli 1.142.0 Source cves: unknown CVE Source advisory:...